Mobile IP Vendor/Organization-Specific Extensions
Two Mobile IP extensions that let vendors and organizations carry their own private data in Mobile IP messages.
Dommety, G. and K. Leung, "Mobile IP Vendor/Organization-Specific Extensions", RFC 3115, DOI 10.17487/RFC3115, April 2001, <https://www.rfc-editor.org/info/rfc3115>.
@misc{rfc3115,
series = {Request for Comments},
number = 3115,
howpublished = {RFC 3115},
publisher = {RFC Editor},
doi = {10.17487/RFC3115},
url = {https://www.rfc-editor.org/info/rfc3115},
author = {G. Dommety and K. Leung},
title = {{Mobile IP Vendor/Organization-Specific Extensions}},
pagetotal = 9,
year = 2001,
month = apr,
} RFC text
Contents
Network Working Group G. Dommety
Request for Comments: 3115 K. Leung
Obsoletes: 3025 cisco Systems
Category: Standards Track April 2001
Mobile IP Vendor/Organization-Specific Extensions
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved.
RFC Editor Note:
This memo corrects discrepancies between the values assigned for
CVSE-TYPE-NUMBER and NVSE-TYPE-NUMBER in RFC 3025 and in the Internet
Assigned Numbers Authority's (IANA) repository. The difference in
the assigned values are as follows:
CVSE-TYPE-NUMBER = 37 in RFC 3025
CVSE-TYPE-NUMBER = 38 in IANA (Under Mobile IP numbers)
NVSE-TYPE-NUMBER = 133 in RFC 3025
NVSE-TYPE-NUMBER = 134 in IANA (Under Mobile IP numbers)
This memo obsoletes RFC 3025, since the current implementations
follow the IANA assignments.
Abstract
This document defines two new extensions to Mobile IP. These
extensions will facilitate equipment vendors and organizations to
make specific use of these extensions as they see fit for research or
deployment purposes.
1. Introduction
Current specification of Mobile IP [1] does not allow for
organizations and vendors to include organization/vendor-specific
information in the Mobile IP messages. With the imminent wide scale
deployment of Mobile IP it is useful to have vendor or organization-
Specific Extensions to support this capability. This document
defines two extensions that can be used for making organization
specific extensions by vendors/organizations for their own specific
purposes.
1.1. Specification Language
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [3].
In addition, the following words are used to signify the requirements
of the specification.
silently discard
The implementation discards the datagram without further
processing, and without indicating an error to the sender.
The implementation SHOULD provide the capability of logging
the error, including the contents of the discarded datagram,
and SHOULD record the event in a statistics counter.
2. Vendor/Organization Specific Extensions
Two Vendor/Organization Specific Extensions are described, Critical
(CVSE) and Normal (NVSE) Vendor/Organization Specific Extensions.
The basic differences between the Critical and Normal Extensions are
that when the Critical extension is encountered but not recognized,
the message containing the extension MUST be silently discarded,
whereas when a Normal Vendor/Organization Specific Extension is
encountered but not recognized, the extension SHOULD be ignored, but
the rest of the Extensions and message data MUST still be processed.
Another difference between the two is that Critical
Vendor/Organization Extension has a length field of two octets and
the NVSE has a length field of only one octet.
2.1. Critical Vendor/Organization Specific Extension (CVSE)
The format of this extension is as shown below.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Reserved | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor/Org-ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-CVSE-Type | Vendor-CVSE-Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Critical Vendor/Organization Specific Extension
Type CVSE-TYPE-NUMBER 38
Reserved Reserved for future use. MUST be set to 0 on sending,
MUST be ignored on reception.
Length Length in bytes of this extension, not including the Type
and Length bytes.
Vendor/Org-ID
The high-order octet is 0 and the low-order 3 octets are
the SMI Network Management Private Enterprise Code of the
Vendor in network byte order, as defined in the Assigned
Numbers RFC [2].
Vendor-CVSE-Type
Indicates the particular type of Vendor-CVSE-Extension.
The administration of the Vendor-CVSE-Types is done by the
Vendor.
Vendor-CVSE-Value
Vendor/organization specific data of this Vendor-CVSE-
Extension. These data fields may be published in future
RFCs. The Vendor-CVSE-Value is zero or more octets. The
length of this field can be computed from the Length Field
Value.
If an implementation does not recognize the CVSE, according to RFC
2002 [1], the entire packet is to be silently dropped.
2.2. Normal Vendor/Organization Specific Extension (NVSE)
The format of this extension is as shown below.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor/Org-ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-NVSE-Type | Vendor-NVSE-Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: Normal Vendor/Organization Specific Extension
Type NVSE-TYPE-NUMBER 134
Length Length in bytes of this extension, not including the Type
and Length bytes.
Reserved Reserved for future use. To be set to 0.
Vendor/Org-ID
The high-order octet is 0 and the low-order 3 octets are
the SMI Network Management Private Enterprise Code of the
Vendor in network byte order, as defined in the Assigned
Numbers RFC [2].
Vendor-NVSE-Type Indicates the particular type of Vendor-NVSE-
Extension. The administration of the Vendor-NVSE-Types is
done by the Vendor.
Vendor-NVSE-Value
Vendor/organization specific data of this Vendor-NVSE-
Extension. These data fields may be published in future
RFCs. The Vendor-NVSE-Value is zero or more octets. The
length of this field can be computed from the Length
Field Value.
2.3 Vendor/Organization Specific Extensions Processing Considerations
When a Mobile IP entity receives a registration request message (or
any other request/update message) with an extension of type CVSE-
TYPE-NUMBER and recognizes it, but the extension contains an
unknown/unsupported vendor ID or Vendor-CVSE-Type, a registration
reject (or the appropriate deny message) MUST be sent with the error
code to indicate that the registration was rejected due to the
presence of an unknown CVSE.
When a Mobile IP entity receives a registration reply (or any other
mobile IP reply/acknowledgement message) with an extension of type
CVSE-TYPE-NUMBER and recognizes it, but the extensions contains an
unknown/unsupported vendor ID or Vendor-CVSE-Type, the processing is
performed as described below.
1. If the Mobile IP entity is a transit node for the reply (i.e.,
this entity processes and sends the registration reply to another
entity) a registration reject (or the appropriate deny message) MUST
be sent with the error code to indicate that the registration was
rejected due to the presence of an unknown CVSE. For example, FA
when it receives an unknown CVSE in a registration reply from the HA,
should send a registration reject to the MN.
2. If the Mobile IP entity is not a transit node for the reply, the
reply is treated as a reject (or the appropriate deny message) due to
the presence of an unknown CVSE.
While designing enhancements wherein a CVSE is included in a reply
message, it should noted that the reply message could be discarded by
the mobile IP entity processing this message. Enhancements that
include a CVSE should take this into consideration during design.
When a Mobile IP entity receives a mobile IP related message
(registration request/reply, advertisement/solicitation, etc.) with
an extension of type NVSE-TYPE-NUMBER and recognizes it, but the
extension contains an unknown/unsupported vendor ID or Vendor-NVSE-
Type, the entire extension is skipped.
NOTE that according to RFC 2002 [1], when an extension numbered
within the range 0 through 127 is encountered in a registration
message but not recognized, the message containing that extension
MUST be silently discarded. This document is compliant with the
above specification and specifies the action if the extension of type
CVSE-TYPE-NUMBER is encountered and recognized, but does not support
the vendor ID or the vendor type extension within.
2.4 Error Codes
The following error codes are defined.
Registration denied by the Foreign agent:
ERROR-FA-1 100: Unsupported Vendor-ID or
unable to interpret Vendor-CVSE-Type in the CVSE sent by the
Mobile Node to the Foreign Agent.
ERROR-FA-2 101: Unsupported Vendor-ID or
unable to interpret Vendor-CVSE-Type in the CVSE sent by the
Home Agent to the Foreign Agent.
Registration denied by the Home agent:
ERROR-HA-1 140: Unsupported Vendor-ID or
unable to interpret Vendor-CVSE-Type in the CVSE sent by the
Mobile Node to the Home Agent.
ERROR-HA-2 141: Unsupported Vendor-ID or
unable to interpret Vendor-CVSE-Type in the CVSE sent by the
Foreign Agent to the Home Agent.
3. Restrictions
Multiple TLV's with the types CVSE-TYPE-NUMBER and NVSE-TYPE-NUMBER
can be included in a message. TLVs with types CVSE-TYPE-NUMBER and
NVSE-TYPE-NUMBER can be placed anywhere after the fixed portion of
the Mobile IP message. These TLVs are expected to be protected by
the corresponding authenticator as necessary. Ordering of these
TLV's should not be modified by intermediate nodes.
4. IANA Considerations
The Critical Vendor/Organization Specific Extension (CVSE) as defined
in Section 2.1 and Normal Vendor/Organization Specific Extension
(NVSE) as defined in section 2.2 are proposed new extensions to the
Mobile IP protocol, defined in RFC 2002 [1] and extended in RFC 2356
[5].
IANA has assigned a Type value of CVSE-TYPE-NUMBER for the Critical
Vendor/Organization Specific Extension (CVSE), and a Type value of
NVSE-TYPE-NUMBER for the Normal Vendor/Organization Specific
Extension (NVSE). The numbers CVSE-TYPE-NUMBER and NVSE-TYPE-NUMBER
for the CVSE and the NVSE are taken from the numbering space defined
for Mobile IP registration extensions [1].
IANA has assigned new Foreign Agent Error Codes, ERROR-FA-1 and
ERROR-FA-2 taken from the numbering space defined for Mobile IP
Foreign Agent error codes [1]. IANA has also assigned new Home Agent
Error Codes, ERROR-HA-1 and ERROR-HA-2 taken from the numbering space
defined for Mobile IP Home Agent error codes [1].
5. Security Considerations
This document assumes that the Mobile IP messages are authenticated
using a method defined by the Mobile IP protocol. This document does
not impose any additional requirements on Mobile IP messages from a
security point of view. So this is not expected to be a security
issue.
6. Acknowledgments
The authors would like to thank TR45.4 WG, TR45.6 WG, Basavaraj
Patil, Phil Roberts, Jouni Malinen, and Patrice Calhoun for their
useful discussions.
7. References
[1] Perkins, C., "IP Mobility Support", RFC 2002, October 1996.
[2] Reynolds, J. and J. Postel, "Assigned Numbers", STD 2, RFC 1700,
October 1994.
[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[4] Montenegro, G., "Reverse Tunneling for Mobile IP", RFC 2344, May
1998.
[5] Montenegro, G. and V. Gupta, "Sun's SKIP Firewall Traversal for
Mobile IP", RFC 2356, June 1998.
8. Authors' Addresses
Gopal Dommety
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
EMail: gdommety@cisco.com
Kent Leung
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
EMail: kleung@cisco.com
9. Full Copyright Statement
Copyright (C) The Internet Society (2001). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
ISO Plain Language
On this page
§1Why Vendor Extensions Were Needed
The current specification of Mobile IP (RFC 2002) does not allow organizations and vendors to include organization or vendor-specific information in Mobile IP messages. With the imminent wide-scale deployment of Mobile IP, the RFC says it is useful to have vendor or organization-specific extensions to support this capability. The document defines two extensions that vendors and organizations can use for their own specific purposes, for research or deployment.
The RFC also defines the term silently discard. An implementation that silently discards a datagram does so without further processing and without indicating an error to the sender. The implementation SHOULD provide the capability of logging the error, including the contents of the discarded datagram, and SHOULD record the event in a statistics counter.
The RFC Editor's note at the top of the document explains why it exists. It corrects discrepancies between the values assigned for CVSE-TYPE-NUMBER and NVSE-TYPE-NUMBER in RFC 3025 and in the Internet Assigned Numbers Authority's repository. In RFC 3025 the CVSE type number was 37 and the NVSE type number was 133, while in the IANA registry under Mobile IP numbers they are 38 and 134. The note says the memo obsoletes RFC 3025, since the current implementations follow the IANA assignments.
Mobile IP messages have a fixed set of fields, and no room for a vendor to add its own. This RFC defines two optional blocks that can be added to those messages, so a vendor or organization can carry its own data. One of them is critical: if the receiver does not understand it, the whole message is thrown away.
§2The Two Extension Formats
Two Vendor/Organization Specific Extensions are described, the Critical (CVSE) and the Normal (NVSE). The basic differences are that when a Critical extension is encountered but not recognized, the message containing it MUST be silently discarded, whereas when a Normal extension is encountered but not recognized the extension SHOULD be ignored but the rest of the extensions and message data MUST still be processed. The second difference is that the Critical extension has a length field of two octets and the NVSE a length field of only one octet.
The Critical Vendor/Organization Specific Extension has four fields before the data. Type is the value 38. Reserved is reserved for future use, MUST be set to 0 on sending and MUST be ignored on reception. Length is the length in bytes of this extension, not including the Type and Length bytes. Vendor/Org-ID has a high-order octet of 0 and the low-order three octets are the SMI Network Management Private Enterprise Code of the vendor, in network byte order, as defined in the Assigned Numbers RFC (RFC 1700).
After those comes Vendor-CVSE-Type, a 16-bit value indicating the particular type of Vendor-CVSE-Extension, whose administration is done by the vendor, and Vendor-CVSE-Value, the vendor or organization specific data, which is zero or more octets and whose length can be computed from the Length field value. The RFC notes that if an implementation does not recognize the CVSE, according to RFC 2002 the entire packet is to be silently dropped.
The Normal Vendor/Organization Specific Extension has the same shape with two differences. Type is the value 134, and Length is one octet rather than two, with the Reserved field taking the two octets that the length field occupies in the Critical extension. The Vendor/Org-ID is formed the same way, and Vendor-NVSE-Type and Vendor-NVSE-Value play the same roles as their Critical counterparts, with the administration of the types done by the vendor.
Both blocks start with a type number and a length, then a vendor code and a type number of the vendor's own choosing, then the data. The critical block has a two-byte length field and the normal one a single byte, so the critical block can carry more data.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
TYPE | Type | 1 byte | 38 | The CVSE type number. |
RESERVED | Reserved | 1 byte | 0 | Must be 0 on sending and ignored on reception. |
LENGTH | Length | 2 bytes | Length in bytes of this extension, not including Type and Length. | |
VENDOR-ORG-ID | Vendor/Org-ID | 4 bytes | High-order octet 0, then the vendor's private enterprise code. | |
VENDOR-CVSE-TYPE | Vendor-CVSE-Type | 2 bytes | The vendor's own type number for this extension. | |
VENDOR-CVSE-VALUE | Vendor-CVSE-Value | 1 byte | Vendor data, zero or more octets, computed from the Length field. |
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
TYPE | Type | 1 byte | 134 | The NVSE type number. |
LENGTH | Length | 1 byte | Length in bytes of this extension, not including Type and Length. | |
RESERVED | Reserved | 2 bytes | 0 | To be set to 0. |
VENDOR-ORG-ID | Vendor/Org-ID | 4 bytes | High-order octet 0, then the vendor's private enterprise code. | |
VENDOR-NVSE-TYPE | Vendor-NVSE-Type | 2 bytes | The vendor's own type number for this extension. | |
VENDOR-NVSE-VALUE | Vendor-NVSE-Value | 1 byte | Vendor data, zero or more octets, computed from the Length field. |
§2.3How Extensions Are Processed
Section 2.3 of the RFC gives the processing rules, and they differ between the two extension types.
When a Mobile IP entity receives a registration request message, or any other request or update message, with an extension of type CVSE-TYPE-NUMBER and recognizes it, but the extension contains an unknown or unsupported vendor ID or Vendor-CVSE-Type, a registration reject, or the appropriate deny message, MUST be sent with the error code indicating that the registration was rejected because of the presence of an unknown CVSE.
When the entity receives a registration reply, or any other Mobile IP reply or acknowledgement message, with an extension of type CVSE-TYPE-NUMBER and recognizes it, but the extension contains an unknown or unsupported vendor ID or Vendor-CVSE-Type, the processing depends on the entity's role. If the entity is a transit node for the reply, that is, it processes the registration reply and sends it to another entity, a registration reject MUST be sent with the error code for an unknown CVSE. The RFC's example is that a foreign agent receiving an unknown CVSE in a registration reply from the home agent should send a registration reject to the mobile node. If the entity is not a transit node for the reply, the reply is treated as a reject because of the presence of an unknown CVSE.
The RFC adds a caution for designers: while designing enhancements in which a CVSE is included in a reply message, it should be noted that the reply message could be discarded by the Mobile IP entity processing it. Enhancements that include a CVSE should take that into account.
When a Mobile IP entity receives a Mobile IP related message, such as a registration request or reply or an advertisement or solicitation, with an extension of type NVSE-TYPE-NUMBER and recognizes it, but the extension contains an unknown or unsupported vendor ID or Vendor-NVSE-Type, the entire extension is skipped.
The RFC notes that according to RFC 2002, when an extension numbered within the range 0 through 127 is encountered in a registration message but not recognized, the message containing that extension MUST be silently discarded. It states that the document is compliant with that specification, and specifies the action for the case where the extension type is CVSE-TYPE-NUMBER and is recognized but the vendor ID or the vendor type within it is not supported.
What happens depends on whether the receiver understands the block. If it recognises the block type but not the vendor or the vendor's own type, then in a request it must reject the registration, and in a reply it must either reject it or pass a rejection back. A normal block with an unknown vendor is simply skipped, and the rest of the message is processed as usual.
| Aspect | CVSE | NVSE |
|---|---|---|
| Type number | 38 | 134 |
| Length field | Two octets | One octet |
| When the vendor is unknown THIS RFC | The whole message is discarded | The extension is skipped and the rest is processed |
§2.4New Error Codes
Section 2.4 defines four error codes, in two pairs.
Registration denied by the Foreign Agent. ERROR-FA-1, code 100: unsupported Vendor-ID, or unable to interpret the Vendor-CVSE-Type, in the CVSE sent by the Mobile Node to the Foreign Agent. ERROR-FA-2, code 101: unsupported Vendor-ID, or unable to interpret the Vendor-CVSE-Type, in the CVSE sent by the Home Agent to the Foreign Agent.
Registration denied by the Home Agent. ERROR-HA-1, code 140: unsupported Vendor-ID, or unable to interpret the Vendor-CVSE-Type, in the CVSE sent by the Mobile Node to the Home Agent. ERROR-HA-2, code 141: unsupported Vendor-ID, or unable to interpret the Vendor-CVSE-Type, in the CVSE sent by the Foreign Agent to the Home Agent.
Four new error codes say why a registration was rejected. Two are for the foreign agent and two for the home agent, and each pair covers a CVSE that came from the mobile node and one that came from the other agent.
- 100ERROR-FA-1 — Foreign agent: unsupported Vendor-ID or Vendor-CVSE-Type in the CVSE from the Mobile Node.
- 101ERROR-FA-2 — Foreign agent: unsupported Vendor-ID or Vendor-CVSE-Type in the CVSE from the Home Agent.
- 140ERROR-HA-1 — Home agent: unsupported Vendor-ID or Vendor-CVSE-Type in the CVSE from the Mobile Node.
- 141ERROR-HA-2 — Home agent: unsupported Vendor-ID or Vendor-CVSE-Type in the CVSE from the Foreign Agent.
§3Restrictions on Placement
Section 3 of the RFC states the restrictions on how these extensions may be used. Multiple TLVs with the types CVSE-TYPE-NUMBER and NVSE-TYPE-NUMBER can be included in a message. TLVs of those two types can be placed anywhere after the fixed portion of the Mobile IP message. These TLVs are expected to be protected by the corresponding authenticator as necessary, and their ordering should not be modified by intermediate nodes.
More than one of these blocks can appear in a message, and they can go anywhere after the fixed part of the message. The order is not to be changed by any node in the middle, and they are expected to be covered by the message's authenticator.
§4IANA Assignments
The Critical Vendor/Organization Specific Extension defined in Section 2.1 and the Normal Vendor/Organization Specific Extension defined in Section 2.2 are new extensions to the Mobile IP protocol, which is defined in RFC 2002 and extended in RFC 2356.
IANA has assigned a Type value for the CVSE and a Type value for the NVSE, taken from the numbering space defined for Mobile IP registration extensions. IANA has also assigned new Foreign Agent error codes, ERROR-FA-1 and ERROR-FA-2, taken from the numbering space defined for Mobile IP Foreign Agent error codes, and new Home Agent error codes, ERROR-HA-1 and ERROR-HA-2, taken from the numbering space defined for Mobile IP Home Agent error codes.
IANA assigned the type numbers and the four error codes. The RFC also notes that it exists to correct a mismatch: the numbers in the earlier version of this document did not match the ones in the IANA registry, and the implementations followed the registry.
§5Security Considerations
The RFC states that it assumes the Mobile IP messages are authenticated using a method defined by the Mobile IP protocol. It imposes no additional requirements on Mobile IP messages from a security point of view, and says this is not expected to be a security issue.
The RFC assumes the Mobile IP messages are already authenticated by the Mobile IP protocol itself, and adds no further security requirements of its own.